1 line
74 KiB
JSON
1 line
74 KiB
JSON
{"repo": "alphasec92/padmavue.ai", "files": {"README.md": {"82fb3e19d8cf25b5cff5812cd17d882169f6a800": {"t": 1785747242.6530704, "n": 15332, "h": "cb79058afe6f83c7", "c": "# 🛡️ PadmaVue.ai\n\n**AI-Powered Security Review Platform** — Automated threat modeling, compliance mapping, and DevSecOps rule generation.\n\n---\n\n## 🪷 Name & Inspiration\n\n**Padma** (Sanskrit: *\"Lotus\"*) is a word deeply rooted in Indian heritage — see [Padma on Wikipedia](https://en.wikipedia.org/wiki/Padma_(given_name)).\n\n**PadmaVue.ai** draws its name from the **Padmavyuha** (Lotus Formation) — a legendary multi-layered military defense formation from the *Mahabharata*, one of the great ancient Indian epics. The Padmavyuha was an intricate, concentric arrangement of warriors that formed an almost impenetrable defense: attackers could enter, but the layers would close behind them, making escape nearly impossible. Only those who understood every layer of the formation could navigate through it.\n\nThis is the philosophy behind PadmaVue.ai:\n\n- **Layered Defense** — Just as the Padmavyuha organized warriors in deliberate, concentric rings, PadmaVue.ai helps security architects build structured, layered defenses through systematic threat modeling (STRIDE, PASTA, MAESTRO).\n- **Visibility Into Complexity** — *Vue* means \"view.\" The Padmavyuha was devastating because its structure was opaque to outsiders. PadmaVue.ai does the opposite — it gives you full visibility into your security architecture, data flows, trust boundaries, and threat landscape.\n- **Ancient Wisdom, Modern Application** — The Mahabharata teaches that understanding your defense architecture is the difference between resilience and defeat. PadmaVue.ai applies this principle to modern software systems, using AI to automatically analyze, map, and strengthen your security posture.\n\n> *\"The lotus grows from mud but blooms untouched by it.\"* — Just as the lotus rises above, PadmaVue.ai elevates your security architecture above the complexity of modern threats.\n\n---\n\n## 🚀 Quick Start\n\n### Mac / Linux\n```bash\nchmod +x start.sh\n./start.sh\n```\n\n### Windows (PowerShell)\n```powershell\n.\\start.ps1\n```\n\n**That's it!** Open http://localhost:3000\n\n> **First run?** Dependencies will be installed automatically (2-3 minutes).\n\n---\n\n## 📦 Two Modes\n\n| Mode | What's Included | Best For |\n|------|-----------------|----------|\n| **Lite** (default) | Backend + Frontend | Quick demos, development |\n| **Full** | + Neo4j + Qdrant | Production, large projects |\n\n```bash\n# Lite mode (default)\n./start.sh\n\n# Full mode (requires Docker)\n./start.sh --full\n```\n\n---\n\n## 🔄 How It Works\n\n```\n┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐\n│ Upload │───▶│ Elicitation │───▶│ DFD │───▶│ Threats │\n│ Documents │ │ Questions │ │ Generation │ │ + Report │\n└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘\n```\n\n1. **Ingest** — Upload architecture docs, configs, or code\n2. **Elicitation** — AI asks clarifying questions about your system\n3. **DFD Generation** — Auto-generates data flow diagrams (Mermaid)\n4. **Threat Analysis** — STRIDE/PASTA analysis with DREAD scoring\n5. **Report** — Compliance mappings (NIST 800-53, OWASP ASVS) + DevSecOps rules\n\n---\n\n## 📋 Requirements\n\n| Requirement | Version | Check |\n|-------------|---------|-------|\n| Python | 3.11+ | `python3 --version` |\n| Node.js | **20.9+** | `node --version` |\n| npm | 10+ | `npm --version` |\n| Docker | (Full mode only) | `docker --version` |\n\n> ⚠️ **Node.js 20.9+** is required for Next.js 16. Use `nvm install 20` to upgrade.\n\n### Install Dependencies\n\n**macOS:**\n```bash\nbrew install python@3.11 node@20\n# Or use nvm:\nnvm install 20 && nvm use 20\n```\n\n**Ubuntu/Debian:**\n```bash\nsudo apt update && sudo apt install python3.11 python3.11-venv\n# Install Node.js 20 via nvm:\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash\nnvm install 20\n```\n\n**Windows:**\n```powershell\nwinget install Python.Python.3.11\nwinget install OpenJS.NodeJS\n```\n\n---\n\n## 🎯 Usage\n\n### Start Commands\n\n| Command | Mode | Description |\n|---------|------|-------------|\n| `./start.sh` | Lite | Backend + Frontend |\n| `./start.sh --full` | Full | + Neo4j + Qdrant (Docker) |\n| `./start.sh --backend` | Lite | Backend only |\n| `./start.sh --frontend` | Lite | Frontend only |\n| `./start.sh --reset` | - | Clean reinstall |\n\n**Windows:** Replace `./start.sh` with `.\\start.ps1` and `--` with `-` (e.g., `.\\start.ps1 -Full`)\n\n### Stop Commands\n\n```bash\n./stop.sh # Mac/Linux\n.\\stop.ps1 # Windows\n# Or press Ctrl+C\n```\n\n---\n\n## 🐳 Docker\n\n### ⚡ Quick Start with Pre-built Images (Recommended)\n\n**No building required!** Pull and run pre-built images directly:\n\n```bash\n# Download the compose file (update URL for your fork)\ncurl -fsSL https://raw.githubusercontent.com/YOUR_USERNAME/PadmaVue.ai/main/infra/docker/compose/docker-compose.hub.yml -o docker-compose.yml\n\n# Start everything\ndocker compose up -d\n\n# View logs\ndocker compose logs -f\n\n# Stop\ndocker compose down\n```\n\n### Build from Source\n\n#### Lite Mode (No databases)\n```bash\ndocker compose -f infra/docker/compose/compose.lite.yml up --build -d\ndocker compose -f infra/docker/compose/compose.lite.yml logs -f\ndocker compose -f infra/docker/compose/compose.lite.yml down\n```\n\n#### Full Mode (With Neo4j + Qdrant)\n```bash\ndocker compose -f infra/docker/compose/compose.full.yml up --build -d\ndocker compose -f infra/docker/compose/compose.full.yml logs -f\ndocker compose -f infra/docker/compose/compose.full.yml down\n```\n\n> **Note:** If `docker compose` fails, try `docker-compose` (older Docker versions).\n\n### Services (Full Mode)\n\n| Service | URL |\n|---------|-----|\n| Frontend | http://localhost:3000 |\n| Backend | http://localhost:8000 |\n| Neo4j | http://localhost:7474 |\n| Qdrant | http://localhost:6333 |\n\n### Docker Images\n\nPre-built images available on GitHub Container Registry (update paths for your fork):\n\n| Image | Pull Command |\n|-------|--------------|\n| Backend | `docker pull ghcr.io/YOUR_USERNAME/padmavue.ai/backend:latest` |\n| Frontend | `docker pull ghcr.io/YOUR_USERNAME/padmavue.ai/frontend:latest` |\n\n**Tags available:**\n- `latest` — Latest stable build from main branch\n- `v1.0.0` — Specific version (semantic versioning)\n- `sha-abc123` — Specific commit\n\n---\n\n## 🤖 AI Provider Setup\n\nDefault: **Mock Mode** (no AI needed, sample responses)\n\n### Option 1: Ollama (Free, Local) ⭐ Recommended\n\n**Mac/Linux:**\n```bash\ncurl -fsSL https://ollama.com/install.sh | sh\nollama pull llama3.2\nollama serve\n```\n\n**Windows:**\n1. Download from https://ollama.com\n2. Run: `ollama pull llama3.2`\n3. Run: `ollama serve`\n\n**During setup**, the script shows your available models:\n```\nAvailable models:\n 1) llama3.2:latest ...\n 2) deepseek-r1:latest ...\n 3) gpt-oss:20b ...\n\nSelect model (number or name, default: llama3.2): \n```\nEnter a **number** (e.g., `1`) or **model name** (e.g., `llama3.2`).\n\n### Option 2: LM Studio (Free, Local)\n1. Download from https://lmstudio.ai\n2. Load a model → Start local server\n\n### Option 3: Cloud Providers\nConfigure via **⚙️ Settings** in the app:\n- OpenAI (GPT-4)\n- Anthropic (Claude)\n- OpenRouter (100+ models)\n- Google Gemini\n- AWS Bedrock\n\n---\n\n## 🔒 Data Handling & Privacy\n\n### What's Stored Locally\n- Uploaded documents (`./uploads/`)\n- Analysis results (`./data/`)\n- Logs (`./logs/`)\n\n### What's Sent to AI Providers\n- **Mock Mode**: Nothing (offline)\n- **Ollama/LM Studio**: Nothing (local AI)\n- **Cloud Providers**: Document content for analysis\n\n### Running Fully Offline\n1. Use Mock Mode, Ollama, or LM Studio\n2. Use Lite Mode (no external databases)\n\n---\n\n## 📊 API Examples\n\n```bash\n# Health check\ncurl http://localhost:8000/health\n\n# Upload a document\ncurl -X POST http://localhost:8000/api/ingest \\\n -F \"files=@architecture.pdf\" \\\n -F \"project_name=MyProject\"\n\n# Run analysis\ncurl -X POST http://localhost:8000/api/analyze \\\n -H \"Content-Type: application/json\" \\\n -d '{\"project_id\": \"your-project-id\", \"methodology\": \"stride\"}'\n```\n\n**Full API Docs:** http://localhost:8000/docs\n\n---\n\n## 🏗️ Architecture\n\n```\n┌─────────────────────────────────────────────────────────┐\n│ Frontend (Next.js) │\n│ http://localhost:3000 │\n└─────────────────────────────────────────────────────────┘\n │\n ▼\n┌─────────────────────────────────────────────────────────┐\n│ Backend (FastAPI) │\n│ http://localhost:8000 │\n│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │\n│ │ Elicitation │ │ Threat │ │ Compliance │ │\n│ │ Agent │ │ Agent │ │ Agent │ │\n│ └─────────────┘ └─────────────┘ └─────────────┘ │\n│ LangGraph Orchestrator │\n└─────────────────────────────────────────────────────────┘\n │ (Full Mode only) │\n ▼ ▼\n┌───────────────────┐ ┌───────────────────┐\n│ Neo4j (GraphRAG) │ │ Qdrant (VectorRAG)│\n│ localhost:7474 │ │ localhost:6333 │\n└───────────────────┘ └───────────────────┘\n```\n\n---\n\n## 📁 Project Structure\n\n```\nPadmaVue.ai/\n├── start.sh / start.ps1 # Start scripts\n├── stop.sh / stop.ps1 # Stop scripts\n├── infra/\n│ └── docker/\n│ └── compose/ # Docker compose files\n│ ├── compose.lite.yml # Lite mode\n│ ├── compose.full.yml # Full mode\n│ └── docker-compose.hub.yml\n├── scripts/\n│ └── common/ # Shared script utilities\n├── backend/\n│ ├── app/\n│ │ ├── agents/ # LangGraph AI agents\n│ │ ├── api/ # REST endpoints\n│ │ └── engines/ # STRIDE, PASTA, DREAD\n│ └── requirements.txt\n├── frontend/\n│ ├── app/ # Next.js pages\n│ ├── components/ # React components\n│ └── package.json\n├── docs/ # BRD, FRD documentation\n└── env-templates/ # Configuration templates\n```\n\n---\n\n## 🔧 Configuration\n\nEnvironment variables in `backend/.env`:\n\n```bash\n# Storage mode: lite (default) or full\nSTORAGE_MODE=lite\n\n# LLM Provider: mock, ollama, openai, anthropic, etc.\nLLM_PROVIDER=mock\n\n# Ollama (if using)\nOLLAMA_BASE_URL=http://localhost:11434\nOLLAMA_MODEL=llama3.2\n```\n\nSee `env-templates/backend.env` for all options.\n\n---\n\n## 🌐 Web Search (Grounded Responses)\n\nEnable web search for fact-checked AI responses with citations.\n\n### Setup SearXNG (Recommended - Free & Self-hosted)\n\n```bash\n# Start SearXNG search engine\ndocker compose -f infra/docker/compose/docker-compose.search.yml up -d\n\n# Add to backend/.env:\n# SEARCH_PROVIDER=searxng\n\n# Restart backend to apply\n./stop.sh && ./start.sh\n```\n\n### Alternative: Paid Search Providers\n\nConfigure in **⚙️ Settings** or `backend/.env`:\n- **Tavily** - AI-optimized search (`TAVILY_API_KEY`)\n- **Serper** - Google Search API (`SERPER_API_KEY`)\n- **Brave** - Privacy-focused (`BRAVE_API_KEY`)\n- **Bing** - Microsoft Search (`BING_API_KEY`)\n\n### Features\n\n- 🔍 **Grounded Responses** - AI answers backed by real-time web search\n- 📚 **Citations** - Sources linked in every response\n- ✅ **Fact-checking** - Reduces AI hallucinations\n- 🔒 **Privacy** - SearXNG is self-hosted, no data sent externally\n\n---\n\n## ❓ Troubleshooting\n\n### \"LLM Provider Not Configured\"\n\nThis appears when no AI model is configured. **Solutions:**\n\n1. **Use the Settings UI** — Click the **\"Configure in Settings\"** button shown in the error\n2. **Or configure manually:**\n ```bash\n # For Ollama (free, local)\n ollama serve # Start Ollama\n # Then in backend/.env:\n LLM_PROVIDER=ollama\n OLLAMA_MODEL=llama3.2\n ```\n3. **Or use Mock Mode** for testing (no AI needed):\n ```bash\n # In backend/.env:\n LLM_PROVIDER=mock\n ```\n\n### \"Backend not connected\"\n```bash\ncurl http://localhost:8000/health # Should return {\"status\":\"healthy\"...}\n./stop.sh && ./start.sh # Restart\n```\n\n### \"Port already in use\"\n```bash\n# Mac/Linux\nlsof -ti :8000 | xargs kill -9\nlsof -ti :3000 | xargs kill -9\n\n# Windows\n.\\stop.ps1\n```\n\n### \"command not found: uvicorn\"\n```bash\ncd backend && source venv/bin/activate\n```\n\n### \"Execution Policy\" error (Windows)\n```powershell\npowershell -ExecutionPolicy Bypass -File start.ps1\n```\n\n### Reset everything\n```bash\n./start.sh --reset\n```\n\n---\n\n## 🔬 Features\n\n| Feature | Description |\n|---------|-------------|\n| STRIDE Analysis | Systematic threat categorization |\n| PASTA Methodology | 7-stage risk-centric analysis |\n| MAESTRO Framework | Agentic AI threat modeling (CSA) |\n| DREAD Scoring | Quantified risk (1-10 scale) |\n| Compliance Mapping | NIST 800-53, OWASP ASVS |\n| **OWASP Citations** | Deterministic reference mapping (no hallucination) |\n| DFD Generation | Mermaid data flow diagrams |\n| DevSecOps Rules | Checkov, tfsec, Semgrep |\n| MCP Integration | External security tools |\n| **AI/ML Threat Modeling** | Specialized questions for AI agents, MCP, tool-calling |\n| **Web Search** | Grounded responses with citations (SearXNG) |\n\n### OWASP Reference Citations\n\nReports include deterministic mappings to OWASP guidance:\n\n| Reference | Scope |\n|-----------|-------|\n| [OWASP Top 10:2025](https://owasp.org/Top10/2025/) | Web application risks |\n| [OWASP LLM Top 10](https://genai.owasp.org/llm-top-10/) | LLM/GenAI security |\n| [OWASP Agentic AI Threats](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/) | Autonomous agent risks |\n| [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | Agentic app Top 10 |\n| [GenAI Red Teaming Guide](https://genai.owasp.org/resource/genai-red-teaming-guide/) | AI security testing |\n\n**Hard Rules:**\n- References mapped deterministically (no hallucination)\n- If mapping rules don't match, findings are flagged for manual review\n- No claims of compliance - guidance references only\n\n---\n\n## 📚 References\n\n- [STRIDE](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)\n- [PASTA](https://owasp.org/www-project-threat-model/)\n- [MAESTRO (CSA)](https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro)\n- [NIST 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)\n- [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)\n- [OWASP GenAI](https://genai.owasp.org/)\n\n---\n\n## 🤝 Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## 🔐 Security\n\nSee [SECURITY.md](SECURITY.md) for reporting vulnerabilities.\n\n## 🔄 Dependabot\n\nThis repository uses [Dependabot](https://docs.github.com/en/code-security/dependabot) for automated dependency updates.\n\n### Enabling Dependabot\n\n1. Go to your repository on GitHub\n2. Navigate to **Settings** → **Code security and analysis**\n3. Enable **Dependabot alerts** for vulnerability notifications\n4. Enable **Dependabot security updates** for automatic security patches\n5. Enable **Dependabot version updates** for weekly dependency updates\n\nThe configuration file is at `.github/dependabot.yml` and covers:\n- Python dependencies (backend)\n- npm dependencies (frontend)\n- Docker base images\n- GitHub Actions\n\n## 📄 License\n\nMIT License - See [LICENSE](LICENSE) file.\n\n---\n\nBuilt with ❤️ by PadmaVue.ai\n"}, "f019cdc5215c074820780fde821744b332a3ce0b": {"t": 1785771657.241334, "n": 15332, "h": "cb79058afe6f83c7", "c": "# 🛡️ PadmaVue.ai\n\n**AI-Powered Security Review Platform** — Automated threat modeling, compliance mapping, and DevSecOps rule generation.\n\n---\n\n## 🪷 Name & Inspiration\n\n**Padma** (Sanskrit: *\"Lotus\"*) is a word deeply rooted in Indian heritage — see [Padma on Wikipedia](https://en.wikipedia.org/wiki/Padma_(given_name)).\n\n**PadmaVue.ai** draws its name from the **Padmavyuha** (Lotus Formation) — a legendary multi-layered military defense formation from the *Mahabharata*, one of the great ancient Indian epics. The Padmavyuha was an intricate, concentric arrangement of warriors that formed an almost impenetrable defense: attackers could enter, but the layers would close behind them, making escape nearly impossible. Only those who understood every layer of the formation could navigate through it.\n\nThis is the philosophy behind PadmaVue.ai:\n\n- **Layered Defense** — Just as the Padmavyuha organized warriors in deliberate, concentric rings, PadmaVue.ai helps security architects build structured, layered defenses through systematic threat modeling (STRIDE, PASTA, MAESTRO).\n- **Visibility Into Complexity** — *Vue* means \"view.\" The Padmavyuha was devastating because its structure was opaque to outsiders. PadmaVue.ai does the opposite — it gives you full visibility into your security architecture, data flows, trust boundaries, and threat landscape.\n- **Ancient Wisdom, Modern Application** — The Mahabharata teaches that understanding your defense architecture is the difference between resilience and defeat. PadmaVue.ai applies this principle to modern software systems, using AI to automatically analyze, map, and strengthen your security posture.\n\n> *\"The lotus grows from mud but blooms untouched by it.\"* — Just as the lotus rises above, PadmaVue.ai elevates your security architecture above the complexity of modern threats.\n\n---\n\n## 🚀 Quick Start\n\n### Mac / Linux\n```bash\nchmod +x start.sh\n./start.sh\n```\n\n### Windows (PowerShell)\n```powershell\n.\\start.ps1\n```\n\n**That's it!** Open http://localhost:3000\n\n> **First run?** Dependencies will be installed automatically (2-3 minutes).\n\n---\n\n## 📦 Two Modes\n\n| Mode | What's Included | Best For |\n|------|-----------------|----------|\n| **Lite** (default) | Backend + Frontend | Quick demos, development |\n| **Full** | + Neo4j + Qdrant | Production, large projects |\n\n```bash\n# Lite mode (default)\n./start.sh\n\n# Full mode (requires Docker)\n./start.sh --full\n```\n\n---\n\n## 🔄 How It Works\n\n```\n┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐\n│ Upload │───▶│ Elicitation │───▶│ DFD │───▶│ Threats │\n│ Documents │ │ Questions │ │ Generation │ │ + Report │\n└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘\n```\n\n1. **Ingest** — Upload architecture docs, configs, or code\n2. **Elicitation** — AI asks clarifying questions about your system\n3. **DFD Generation** — Auto-generates data flow diagrams (Mermaid)\n4. **Threat Analysis** — STRIDE/PASTA analysis with DREAD scoring\n5. **Report** — Compliance mappings (NIST 800-53, OWASP ASVS) + DevSecOps rules\n\n---\n\n## 📋 Requirements\n\n| Requirement | Version | Check |\n|-------------|---------|-------|\n| Python | 3.11+ | `python3 --version` |\n| Node.js | **20.9+** | `node --version` |\n| npm | 10+ | `npm --version` |\n| Docker | (Full mode only) | `docker --version` |\n\n> ⚠️ **Node.js 20.9+** is required for Next.js 16. Use `nvm install 20` to upgrade.\n\n### Install Dependencies\n\n**macOS:**\n```bash\nbrew install python@3.11 node@20\n# Or use nvm:\nnvm install 20 && nvm use 20\n```\n\n**Ubuntu/Debian:**\n```bash\nsudo apt update && sudo apt install python3.11 python3.11-venv\n# Install Node.js 20 via nvm:\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash\nnvm install 20\n```\n\n**Windows:**\n```powershell\nwinget install Python.Python.3.11\nwinget install OpenJS.NodeJS\n```\n\n---\n\n## 🎯 Usage\n\n### Start Commands\n\n| Command | Mode | Description |\n|---------|------|-------------|\n| `./start.sh` | Lite | Backend + Frontend |\n| `./start.sh --full` | Full | + Neo4j + Qdrant (Docker) |\n| `./start.sh --backend` | Lite | Backend only |\n| `./start.sh --frontend` | Lite | Frontend only |\n| `./start.sh --reset` | - | Clean reinstall |\n\n**Windows:** Replace `./start.sh` with `.\\start.ps1` and `--` with `-` (e.g., `.\\start.ps1 -Full`)\n\n### Stop Commands\n\n```bash\n./stop.sh # Mac/Linux\n.\\stop.ps1 # Windows\n# Or press Ctrl+C\n```\n\n---\n\n## 🐳 Docker\n\n### ⚡ Quick Start with Pre-built Images (Recommended)\n\n**No building required!** Pull and run pre-built images directly:\n\n```bash\n# Download the compose file (update URL for your fork)\ncurl -fsSL https://raw.githubusercontent.com/YOUR_USERNAME/PadmaVue.ai/main/infra/docker/compose/docker-compose.hub.yml -o docker-compose.yml\n\n# Start everything\ndocker compose up -d\n\n# View logs\ndocker compose logs -f\n\n# Stop\ndocker compose down\n```\n\n### Build from Source\n\n#### Lite Mode (No databases)\n```bash\ndocker compose -f infra/docker/compose/compose.lite.yml up --build -d\ndocker compose -f infra/docker/compose/compose.lite.yml logs -f\ndocker compose -f infra/docker/compose/compose.lite.yml down\n```\n\n#### Full Mode (With Neo4j + Qdrant)\n```bash\ndocker compose -f infra/docker/compose/compose.full.yml up --build -d\ndocker compose -f infra/docker/compose/compose.full.yml logs -f\ndocker compose -f infra/docker/compose/compose.full.yml down\n```\n\n> **Note:** If `docker compose` fails, try `docker-compose` (older Docker versions).\n\n### Services (Full Mode)\n\n| Service | URL |\n|---------|-----|\n| Frontend | http://localhost:3000 |\n| Backend | http://localhost:8000 |\n| Neo4j | http://localhost:7474 |\n| Qdrant | http://localhost:6333 |\n\n### Docker Images\n\nPre-built images available on GitHub Container Registry (update paths for your fork):\n\n| Image | Pull Command |\n|-------|--------------|\n| Backend | `docker pull ghcr.io/YOUR_USERNAME/padmavue.ai/backend:latest` |\n| Frontend | `docker pull ghcr.io/YOUR_USERNAME/padmavue.ai/frontend:latest` |\n\n**Tags available:**\n- `latest` — Latest stable build from main branch\n- `v1.0.0` — Specific version (semantic versioning)\n- `sha-abc123` — Specific commit\n\n---\n\n## 🤖 AI Provider Setup\n\nDefault: **Mock Mode** (no AI needed, sample responses)\n\n### Option 1: Ollama (Free, Local) ⭐ Recommended\n\n**Mac/Linux:**\n```bash\ncurl -fsSL https://ollama.com/install.sh | sh\nollama pull llama3.2\nollama serve\n```\n\n**Windows:**\n1. Download from https://ollama.com\n2. Run: `ollama pull llama3.2`\n3. Run: `ollama serve`\n\n**During setup**, the script shows your available models:\n```\nAvailable models:\n 1) llama3.2:latest ...\n 2) deepseek-r1:latest ...\n 3) gpt-oss:20b ...\n\nSelect model (number or name, default: llama3.2): \n```\nEnter a **number** (e.g., `1`) or **model name** (e.g., `llama3.2`).\n\n### Option 2: LM Studio (Free, Local)\n1. Download from https://lmstudio.ai\n2. Load a model → Start local server\n\n### Option 3: Cloud Providers\nConfigure via **⚙️ Settings** in the app:\n- OpenAI (GPT-4)\n- Anthropic (Claude)\n- OpenRouter (100+ models)\n- Google Gemini\n- AWS Bedrock\n\n---\n\n## 🔒 Data Handling & Privacy\n\n### What's Stored Locally\n- Uploaded documents (`./uploads/`)\n- Analysis results (`./data/`)\n- Logs (`./logs/`)\n\n### What's Sent to AI Providers\n- **Mock Mode**: Nothing (offline)\n- **Ollama/LM Studio**: Nothing (local AI)\n- **Cloud Providers**: Document content for analysis\n\n### Running Fully Offline\n1. Use Mock Mode, Ollama, or LM Studio\n2. Use Lite Mode (no external databases)\n\n---\n\n## 📊 API Examples\n\n```bash\n# Health check\ncurl http://localhost:8000/health\n\n# Upload a document\ncurl -X POST http://localhost:8000/api/ingest \\\n -F \"files=@architecture.pdf\" \\\n -F \"project_name=MyProject\"\n\n# Run analysis\ncurl -X POST http://localhost:8000/api/analyze \\\n -H \"Content-Type: application/json\" \\\n -d '{\"project_id\": \"your-project-id\", \"methodology\": \"stride\"}'\n```\n\n**Full API Docs:** http://localhost:8000/docs\n\n---\n\n## 🏗️ Architecture\n\n```\n┌─────────────────────────────────────────────────────────┐\n│ Frontend (Next.js) │\n│ http://localhost:3000 │\n└─────────────────────────────────────────────────────────┘\n │\n ▼\n┌─────────────────────────────────────────────────────────┐\n│ Backend (FastAPI) │\n│ http://localhost:8000 │\n│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │\n│ │ Elicitation │ │ Threat │ │ Compliance │ │\n│ │ Agent │ │ Agent │ │ Agent │ │\n│ └─────────────┘ └─────────────┘ └─────────────┘ │\n│ LangGraph Orchestrator │\n└─────────────────────────────────────────────────────────┘\n │ (Full Mode only) │\n ▼ ▼\n┌───────────────────┐ ┌───────────────────┐\n│ Neo4j (GraphRAG) │ │ Qdrant (VectorRAG)│\n│ localhost:7474 │ │ localhost:6333 │\n└───────────────────┘ └───────────────────┘\n```\n\n---\n\n## 📁 Project Structure\n\n```\nPadmaVue.ai/\n├── start.sh / start.ps1 # Start scripts\n├── stop.sh / stop.ps1 # Stop scripts\n├── infra/\n│ └── docker/\n│ └── compose/ # Docker compose files\n│ ├── compose.lite.yml # Lite mode\n│ ├── compose.full.yml # Full mode\n│ └── docker-compose.hub.yml\n├── scripts/\n│ └── common/ # Shared script utilities\n├── backend/\n│ ├── app/\n│ │ ├── agents/ # LangGraph AI agents\n│ │ ├── api/ # REST endpoints\n│ │ └── engines/ # STRIDE, PASTA, DREAD\n│ └── requirements.txt\n├── frontend/\n│ ├── app/ # Next.js pages\n│ ├── components/ # React components\n│ └── package.json\n├── docs/ # BRD, FRD documentation\n└── env-templates/ # Configuration templates\n```\n\n---\n\n## 🔧 Configuration\n\nEnvironment variables in `backend/.env`:\n\n```bash\n# Storage mode: lite (default) or full\nSTORAGE_MODE=lite\n\n# LLM Provider: mock, ollama, openai, anthropic, etc.\nLLM_PROVIDER=mock\n\n# Ollama (if using)\nOLLAMA_BASE_URL=http://localhost:11434\nOLLAMA_MODEL=llama3.2\n```\n\nSee `env-templates/backend.env` for all options.\n\n---\n\n## 🌐 Web Search (Grounded Responses)\n\nEnable web search for fact-checked AI responses with citations.\n\n### Setup SearXNG (Recommended - Free & Self-hosted)\n\n```bash\n# Start SearXNG search engine\ndocker compose -f infra/docker/compose/docker-compose.search.yml up -d\n\n# Add to backend/.env:\n# SEARCH_PROVIDER=searxng\n\n# Restart backend to apply\n./stop.sh && ./start.sh\n```\n\n### Alternative: Paid Search Providers\n\nConfigure in **⚙️ Settings** or `backend/.env`:\n- **Tavily** - AI-optimized search (`TAVILY_API_KEY`)\n- **Serper** - Google Search API (`SERPER_API_KEY`)\n- **Brave** - Privacy-focused (`BRAVE_API_KEY`)\n- **Bing** - Microsoft Search (`BING_API_KEY`)\n\n### Features\n\n- 🔍 **Grounded Responses** - AI answers backed by real-time web search\n- 📚 **Citations** - Sources linked in every response\n- ✅ **Fact-checking** - Reduces AI hallucinations\n- 🔒 **Privacy** - SearXNG is self-hosted, no data sent externally\n\n---\n\n## ❓ Troubleshooting\n\n### \"LLM Provider Not Configured\"\n\nThis appears when no AI model is configured. **Solutions:**\n\n1. **Use the Settings UI** — Click the **\"Configure in Settings\"** button shown in the error\n2. **Or configure manually:**\n ```bash\n # For Ollama (free, local)\n ollama serve # Start Ollama\n # Then in backend/.env:\n LLM_PROVIDER=ollama\n OLLAMA_MODEL=llama3.2\n ```\n3. **Or use Mock Mode** for testing (no AI needed):\n ```bash\n # In backend/.env:\n LLM_PROVIDER=mock\n ```\n\n### \"Backend not connected\"\n```bash\ncurl http://localhost:8000/health # Should return {\"status\":\"healthy\"...}\n./stop.sh && ./start.sh # Restart\n```\n\n### \"Port already in use\"\n```bash\n# Mac/Linux\nlsof -ti :8000 | xargs kill -9\nlsof -ti :3000 | xargs kill -9\n\n# Windows\n.\\stop.ps1\n```\n\n### \"command not found: uvicorn\"\n```bash\ncd backend && source venv/bin/activate\n```\n\n### \"Execution Policy\" error (Windows)\n```powershell\npowershell -ExecutionPolicy Bypass -File start.ps1\n```\n\n### Reset everything\n```bash\n./start.sh --reset\n```\n\n---\n\n## 🔬 Features\n\n| Feature | Description |\n|---------|-------------|\n| STRIDE Analysis | Systematic threat categorization |\n| PASTA Methodology | 7-stage risk-centric analysis |\n| MAESTRO Framework | Agentic AI threat modeling (CSA) |\n| DREAD Scoring | Quantified risk (1-10 scale) |\n| Compliance Mapping | NIST 800-53, OWASP ASVS |\n| **OWASP Citations** | Deterministic reference mapping (no hallucination) |\n| DFD Generation | Mermaid data flow diagrams |\n| DevSecOps Rules | Checkov, tfsec, Semgrep |\n| MCP Integration | External security tools |\n| **AI/ML Threat Modeling** | Specialized questions for AI agents, MCP, tool-calling |\n| **Web Search** | Grounded responses with citations (SearXNG) |\n\n### OWASP Reference Citations\n\nReports include deterministic mappings to OWASP guidance:\n\n| Reference | Scope |\n|-----------|-------|\n| [OWASP Top 10:2025](https://owasp.org/Top10/2025/) | Web application risks |\n| [OWASP LLM Top 10](https://genai.owasp.org/llm-top-10/) | LLM/GenAI security |\n| [OWASP Agentic AI Threats](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/) | Autonomous agent risks |\n| [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | Agentic app Top 10 |\n| [GenAI Red Teaming Guide](https://genai.owasp.org/resource/genai-red-teaming-guide/) | AI security testing |\n\n**Hard Rules:**\n- References mapped deterministically (no hallucination)\n- If mapping rules don't match, findings are flagged for manual review\n- No claims of compliance - guidance references only\n\n---\n\n## 📚 References\n\n- [STRIDE](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)\n- [PASTA](https://owasp.org/www-project-threat-model/)\n- [MAESTRO (CSA)](https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro)\n- [NIST 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)\n- [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)\n- [OWASP GenAI](https://genai.owasp.org/)\n\n---\n\n## 🤝 Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## 🔐 Security\n\nSee [SECURITY.md](SECURITY.md) for reporting vulnerabilities.\n\n## 🔄 Dependabot\n\nThis repository uses [Dependabot](https://docs.github.com/en/code-security/dependabot) for automated dependency updates.\n\n### Enabling Dependabot\n\n1. Go to your repository on GitHub\n2. Navigate to **Settings** → **Code security and analysis**\n3. Enable **Dependabot alerts** for vulnerability notifications\n4. Enable **Dependabot security updates** for automatic security patches\n5. Enable **Dependabot version updates** for weekly dependency updates\n\nThe configuration file is at `.github/dependabot.yml` and covers:\n- Python dependencies (backend)\n- npm dependencies (frontend)\n- Docker base images\n- GitHub Actions\n\n## 📄 License\n\nMIT License - See [LICENSE](LICENSE) file.\n\n---\n\nBuilt with ❤️ by PadmaVue.ai\n"}, "5b0f04b59a80cec6a661fed1facf41e922820cf2": {"t": 1785771659.4568217, "n": 13626, "h": "abb67e62c2ec0f7f", "c": "# 🛡️ PadmaVue.ai\n\n**AI-Powered Security Review Platform** — Automated threat modeling, compliance mapping, and DevSecOps rule generation.\n\n---\n\n## 🚀 Quick Start\n\n### Mac / Linux\n```bash\nchmod +x start.sh\n./start.sh\n```\n\n### Windows (PowerShell)\n```powershell\n.\\start.ps1\n```\n\n**That's it!** Open http://localhost:3000\n\n> **First run?** Dependencies will be installed automatically (2-3 minutes).\n\n---\n\n## 📦 Two Modes\n\n| Mode | What's Included | Best For |\n|------|-----------------|----------|\n| **Lite** (default) | Backend + Frontend | Quick demos, development |\n| **Full** | + Neo4j + Qdrant | Production, large projects |\n\n```bash\n# Lite mode (default)\n./start.sh\n\n# Full mode (requires Docker)\n./start.sh --full\n```\n\n---\n\n## 🔄 How It Works\n\n```\n┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐\n│ Upload │───▶│ Elicitation │───▶│ DFD │───▶│ Threats │\n│ Documents │ │ Questions │ │ Generation │ │ + Report │\n└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘\n```\n\n1. **Ingest** — Upload architecture docs, configs, or code\n2. **Elicitation** — AI asks clarifying questions about your system\n3. **DFD Generation** — Auto-generates data flow diagrams (Mermaid)\n4. **Threat Analysis** — STRIDE/PASTA analysis with DREAD scoring\n5. **Report** — Compliance mappings (NIST 800-53, OWASP ASVS) + DevSecOps rules\n\n---\n\n## 📋 Requirements\n\n| Requirement | Version | Check |\n|-------------|---------|-------|\n| Python | 3.11+ | `python3 --version` |\n| Node.js | **20.9+** | `node --version` |\n| npm | 10+ | `npm --version` |\n| Docker | (Full mode only) | `docker --version` |\n\n> ⚠️ **Node.js 20.9+** is required for Next.js 16. Use `nvm install 20` to upgrade.\n\n### Install Dependencies\n\n**macOS:**\n```bash\nbrew install python@3.11 node@20\n# Or use nvm:\nnvm install 20 && nvm use 20\n```\n\n**Ubuntu/Debian:**\n```bash\nsudo apt update && sudo apt install python3.11 python3.11-venv\n# Install Node.js 20 via nvm:\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash\nnvm install 20\n```\n\n**Windows:**\n```powershell\nwinget install Python.Python.3.11\nwinget install OpenJS.NodeJS\n```\n\n---\n\n## 🎯 Usage\n\n### Start Commands\n\n| Command | Mode | Description |\n|---------|------|-------------|\n| `./start.sh` | Lite | Backend + Frontend |\n| `./start.sh --full` | Full | + Neo4j + Qdrant (Docker) |\n| `./start.sh --backend` | Lite | Backend only |\n| `./start.sh --frontend` | Lite | Frontend only |\n| `./start.sh --reset` | - | Clean reinstall |\n\n**Windows:** Replace `./start.sh` with `.\\start.ps1` and `--` with `-` (e.g., `.\\start.ps1 -Full`)\n\n### Stop Commands\n\n```bash\n./stop.sh # Mac/Linux\n.\\stop.ps1 # Windows\n# Or press Ctrl+C\n```\n\n---\n\n## 🐳 Docker\n\n### ⚡ Quick Start with Pre-built Images (Recommended)\n\n**No building required!** Pull and run pre-built images directly:\n\n```bash\n# Download the compose file (update URL for your fork)\ncurl -fsSL https://raw.githubusercontent.com/YOUR_USERNAME/PadmaVue.ai/main/infra/docker/compose/docker-compose.hub.yml -o docker-compose.yml\n\n# Start everything\ndocker compose up -d\n\n# View logs\ndocker compose logs -f\n\n# Stop\ndocker compose down\n```\n\n### Build from Source\n\n#### Lite Mode (No databases)\n```bash\ndocker compose -f infra/docker/compose/compose.lite.yml up --build -d\ndocker compose -f infra/docker/compose/compose.lite.yml logs -f\ndocker compose -f infra/docker/compose/compose.lite.yml down\n```\n\n#### Full Mode (With Neo4j + Qdrant)\n```bash\ndocker compose -f infra/docker/compose/compose.full.yml up --build -d\ndocker compose -f infra/docker/compose/compose.full.yml logs -f\ndocker compose -f infra/docker/compose/compose.full.yml down\n```\n\n> **Note:** If `docker compose` fails, try `docker-compose` (older Docker versions).\n\n### Services (Full Mode)\n\n| Service | URL |\n|---------|-----|\n| Frontend | http://localhost:3000 |\n| Backend | http://localhost:8000 |\n| Neo4j | http://localhost:7474 |\n| Qdrant | http://localhost:6333 |\n\n### Docker Images\n\nPre-built images available on GitHub Container Registry (update paths for your fork):\n\n| Image | Pull Command |\n|-------|--------------|\n| Backend | `docker pull ghcr.io/YOUR_USERNAME/padmavue.ai/backend:latest` |\n| Frontend | `docker pull ghcr.io/YOUR_USERNAME/padmavue.ai/frontend:latest` |\n\n**Tags available:**\n- `latest` — Latest stable build from main branch\n- `v1.0.0` — Specific version (semantic versioning)\n- `sha-abc123` — Specific commit\n\n---\n\n## 🤖 AI Provider Setup\n\nDefault: **Mock Mode** (no AI needed, sample responses)\n\n### Option 1: Ollama (Free, Local) ⭐ Recommended\n\n**Mac/Linux:**\n```bash\ncurl -fsSL https://ollama.com/install.sh | sh\nollama pull llama3.2\nollama serve\n```\n\n**Windows:**\n1. Download from https://ollama.com\n2. Run: `ollama pull llama3.2`\n3. Run: `ollama serve`\n\n**During setup**, the script shows your available models:\n```\nAvailable models:\n 1) llama3.2:latest ...\n 2) deepseek-r1:latest ...\n 3) gpt-oss:20b ...\n\nSelect model (number or name, default: llama3.2): \n```\nEnter a **number** (e.g., `1`) or **model name** (e.g., `llama3.2`).\n\n### Option 2: LM Studio (Free, Local)\n1. Download from https://lmstudio.ai\n2. Load a model → Start local server\n\n### Option 3: Cloud Providers\nConfigure via **⚙️ Settings** in the app:\n- OpenAI (GPT-4)\n- Anthropic (Claude)\n- OpenRouter (100+ models)\n- Google Gemini\n- AWS Bedrock\n\n---\n\n## 🔒 Data Handling & Privacy\n\n### What's Stored Locally\n- Uploaded documents (`./uploads/`)\n- Analysis results (`./data/`)\n- Logs (`./logs/`)\n\n### What's Sent to AI Providers\n- **Mock Mode**: Nothing (offline)\n- **Ollama/LM Studio**: Nothing (local AI)\n- **Cloud Providers**: Document content for analysis\n\n### Running Fully Offline\n1. Use Mock Mode, Ollama, or LM Studio\n2. Use Lite Mode (no external databases)\n\n---\n\n## 📊 API Examples\n\n```bash\n# Health check\ncurl http://localhost:8000/health\n\n# Upload a document\ncurl -X POST http://localhost:8000/api/ingest \\\n -F \"files=@architecture.pdf\" \\\n -F \"project_name=MyProject\"\n\n# Run analysis\ncurl -X POST http://localhost:8000/api/analyze \\\n -H \"Content-Type: application/json\" \\\n -d '{\"project_id\": \"your-project-id\", \"methodology\": \"stride\"}'\n```\n\n**Full API Docs:** http://localhost:8000/docs\n\n---\n\n## 🏗️ Architecture\n\n```\n┌─────────────────────────────────────────────────────────┐\n│ Frontend (Next.js) │\n│ http://localhost:3000 │\n└─────────────────────────────────────────────────────────┘\n │\n ▼\n┌─────────────────────────────────────────────────────────┐\n│ Backend (FastAPI) │\n│ http://localhost:8000 │\n│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │\n│ │ Elicitation │ │ Threat │ │ Compliance │ │\n│ │ Agent │ │ Agent │ │ Agent │ │\n│ └─────────────┘ └─────────────┘ └─────────────┘ │\n│ LangGraph Orchestrator │\n└─────────────────────────────────────────────────────────┘\n │ (Full Mode only) │\n ▼ ▼\n┌───────────────────┐ ┌───────────────────┐\n│ Neo4j (GraphRAG) │ │ Qdrant (VectorRAG)│\n│ localhost:7474 │ │ localhost:6333 │\n└───────────────────┘ └───────────────────┘\n```\n\n---\n\n## 📁 Project Structure\n\n```\nPadmaVue.ai/\n├── start.sh / start.ps1 # Start scripts\n├── stop.sh / stop.ps1 # Stop scripts\n├── infra/\n│ └── docker/\n│ └── compose/ # Docker compose files\n│ ├── compose.lite.yml # Lite mode\n│ ├── compose.full.yml # Full mode\n│ └── docker-compose.hub.yml\n├── scripts/\n│ └── common/ # Shared script utilities\n├── backend/\n│ ├── app/\n│ │ ├── agents/ # LangGraph AI agents\n│ │ ├── api/ # REST endpoints\n│ │ └── engines/ # STRIDE, PASTA, DREAD\n│ └── requirements.txt\n├── frontend/\n│ ├── app/ # Next.js pages\n│ ├── components/ # React components\n│ └── package.json\n├── docs/ # BRD, FRD documentation\n└── env-templates/ # Configuration templates\n```\n\n---\n\n## 🔧 Configuration\n\nEnvironment variables in `backend/.env`:\n\n```bash\n# Storage mode: lite (default) or full\nSTORAGE_MODE=lite\n\n# LLM Provider: mock, ollama, openai, anthropic, etc.\nLLM_PROVIDER=mock\n\n# Ollama (if using)\nOLLAMA_BASE_URL=http://localhost:11434\nOLLAMA_MODEL=llama3.2\n```\n\nSee `env-templates/backend.env` for all options.\n\n---\n\n## 🌐 Web Search (Grounded Responses)\n\nEnable web search for fact-checked AI responses with citations.\n\n### Setup SearXNG (Recommended - Free & Self-hosted)\n\n```bash\n# Start SearXNG search engine\ndocker compose -f infra/docker/compose/docker-compose.search.yml up -d\n\n# Add to backend/.env:\n# SEARCH_PROVIDER=searxng\n\n# Restart backend to apply\n./stop.sh && ./start.sh\n```\n\n### Alternative: Paid Search Providers\n\nConfigure in **⚙️ Settings** or `backend/.env`:\n- **Tavily** - AI-optimized search (`TAVILY_API_KEY`)\n- **Serper** - Google Search API (`SERPER_API_KEY`)\n- **Brave** - Privacy-focused (`BRAVE_API_KEY`)\n- **Bing** - Microsoft Search (`BING_API_KEY`)\n\n### Features\n\n- 🔍 **Grounded Responses** - AI answers backed by real-time web search\n- 📚 **Citations** - Sources linked in every response\n- ✅ **Fact-checking** - Reduces AI hallucinations\n- 🔒 **Privacy** - SearXNG is self-hosted, no data sent externally\n\n---\n\n## ❓ Troubleshooting\n\n### \"LLM Provider Not Configured\"\n\nThis appears when no AI model is configured. **Solutions:**\n\n1. **Use the Settings UI** — Click the **\"Configure in Settings\"** button shown in the error\n2. **Or configure manually:**\n ```bash\n # For Ollama (free, local)\n ollama serve # Start Ollama\n # Then in backend/.env:\n LLM_PROVIDER=ollama\n OLLAMA_MODEL=llama3.2\n ```\n3. **Or use Mock Mode** for testing (no AI needed):\n ```bash\n # In backend/.env:\n LLM_PROVIDER=mock\n ```\n\n### \"Backend not connected\"\n```bash\ncurl http://localhost:8000/health # Should return {\"status\":\"healthy\"...}\n./stop.sh && ./start.sh # Restart\n```\n\n### \"Port already in use\"\n```bash\n# Mac/Linux\nlsof -ti :8000 | xargs kill -9\nlsof -ti :3000 | xargs kill -9\n\n# Windows\n.\\stop.ps1\n```\n\n### \"command not found: uvicorn\"\n```bash\ncd backend && source venv/bin/activate\n```\n\n### \"Execution Policy\" error (Windows)\n```powershell\npowershell -ExecutionPolicy Bypass -File start.ps1\n```\n\n### Reset everything\n```bash\n./start.sh --reset\n```\n\n---\n\n## 🔬 Features\n\n| Feature | Description |\n|---------|-------------|\n| STRIDE Analysis | Systematic threat categorization |\n| PASTA Methodology | 7-stage risk-centric analysis |\n| MAESTRO Framework | Agentic AI threat modeling (CSA) |\n| DREAD Scoring | Quantified risk (1-10 scale) |\n| Compliance Mapping | NIST 800-53, OWASP ASVS |\n| **OWASP Citations** | Deterministic reference mapping (no hallucination) |\n| DFD Generation | Mermaid data flow diagrams |\n| DevSecOps Rules | Checkov, tfsec, Semgrep |\n| MCP Integration | External security tools |\n| **AI/ML Threat Modeling** | Specialized questions for AI agents, MCP, tool-calling |\n| **Web Search** | Grounded responses with citations (SearXNG) |\n\n### OWASP Reference Citations\n\nReports include deterministic mappings to OWASP guidance:\n\n| Reference | Scope |\n|-----------|-------|\n| [OWASP Top 10:2025](https://owasp.org/Top10/2025/) | Web application risks |\n| [OWASP LLM Top 10](https://genai.owasp.org/llm-top-10/) | LLM/GenAI security |\n| [OWASP Agentic AI Threats](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/) | Autonomous agent risks |\n| [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | Agentic app Top 10 |\n| [GenAI Red Teaming Guide](https://genai.owasp.org/resource/genai-red-teaming-guide/) | AI security testing |\n\n**Hard Rules:**\n- References mapped deterministically (no hallucination)\n- If mapping rules don't match, findings are flagged for manual review\n- No claims of compliance - guidance references only\n\n---\n\n## 📚 References\n\n- [STRIDE](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)\n- [PASTA](https://owasp.org/www-project-threat-model/)\n- [MAESTRO (CSA)](https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro)\n- [NIST 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)\n- [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)\n- [OWASP GenAI](https://genai.owasp.org/)\n\n---\n\n## 🤝 Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## 🔐 Security\n\nSee [SECURITY.md](SECURITY.md) for reporting vulnerabilities.\n\n## 🔄 Dependabot\n\nThis repository uses [Dependabot](https://docs.github.com/en/code-security/dependabot) for automated dependency updates.\n\n### Enabling Dependabot\n\n1. Go to your repository on GitHub\n2. Navigate to **Settings** → **Code security and analysis**\n3. Enable **Dependabot alerts** for vulnerability notifications\n4. Enable **Dependabot security updates** for automatic security patches\n5. Enable **Dependabot version updates** for weekly dependency updates\n\nThe configuration file is at `.github/dependabot.yml` and covers:\n- Python dependencies (backend)\n- npm dependencies (frontend)\n- Docker base images\n- GitHub Actions\n\n## 📄 License\n\nMIT License - See [LICENSE](LICENSE) file.\n\n---\n\nBuilt with ❤️ by PadmaVue.ai\n"}, "92fa9725cadc1c2cf7c0f2178d0ff0eb44558d17": {"t": 1785771660.8198981, "n": 11026, "h": "383839662caf1f87", "c": "# 🛡️ PadmaVue.ai\n\n**AI-Powered Security Review Platform** — Automated threat modeling, compliance mapping, and DevSecOps rule generation.\n\n---\n\n## 🚀 Quick Start\n\n### Mac / Linux\n```bash\nchmod +x start.sh\n./start.sh\n```\n\n### Windows (PowerShell)\n```powershell\n.\\start.ps1\n```\n\n**That's it!** Open http://localhost:3000\n\n> **First run?** Dependencies will be installed automatically (2-3 minutes).\n\n---\n\n## 📦 Two Modes\n\n| Mode | What's Included | Best For |\n|------|-----------------|----------|\n| **Lite** (default) | Backend + Frontend | Quick demos, development |\n| **Full** | + Neo4j + Qdrant | Production, large projects |\n\n```bash\n# Lite mode (default)\n./start.sh\n\n# Full mode (requires Docker)\n./start.sh --full\n```\n\n---\n\n## 🔄 How It Works\n\n```\n┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐\n│ Upload │───▶│ Elicitation │───▶│ DFD │───▶│ Threats │\n│ Documents │ │ Questions │ │ Generation │ │ + Report │\n└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘\n```\n\n1. **Ingest** — Upload architecture docs, configs, or code\n2. **Elicitation** — AI asks clarifying questions about your system\n3. **DFD Generation** — Auto-generates data flow diagrams (Mermaid)\n4. **Threat Analysis** — STRIDE/PASTA analysis with DREAD scoring\n5. **Report** — Compliance mappings (NIST 800-53, OWASP ASVS) + DevSecOps rules\n\n---\n\n## 📋 Requirements\n\n| Requirement | Version | Check |\n|-------------|---------|-------|\n| Python | 3.11+ | `python3 --version` |\n| Node.js | **20.9+** | `node --version` |\n| npm | 10+ | `npm --version` |\n| Docker | (Full mode only) | `docker --version` |\n\n> ⚠️ **Node.js 20.9+** is required for Next.js 16. Use `nvm install 20` to upgrade.\n\n### Install Dependencies\n\n**macOS:**\n```bash\nbrew install python@3.11 node@20\n# Or use nvm:\nnvm install 20 && nvm use 20\n```\n\n**Ubuntu/Debian:**\n```bash\nsudo apt update && sudo apt install python3.11 python3.11-venv\n# Install Node.js 20 via nvm:\ncurl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash\nnvm install 20\n```\n\n**Windows:**\n```powershell\nwinget install Python.Python.3.11\nwinget install OpenJS.NodeJS\n```\n\n---\n\n## 🎯 Usage\n\n### Start Commands\n\n| Command | Mode | Description |\n|---------|------|-------------|\n| `./start.sh` | Lite | Backend + Frontend |\n| `./start.sh --full` | Full | + Neo4j + Qdrant (Docker) |\n| `./start.sh --backend` | Lite | Backend only |\n| `./start.sh --frontend` | Lite | Frontend only |\n| `./start.sh --reset` | - | Clean reinstall |\n\n**Windows:** Replace `./start.sh` with `.\\start.ps1` and `--` with `-` (e.g., `.\\start.ps1 -Full`)\n\n### Stop Commands\n\n```bash\n./stop.sh # Mac/Linux\n.\\stop.ps1 # Windows\n# Or press Ctrl+C\n```\n\n---\n\n## 🐳 Docker\n\n### ⚡ Quick Start with Pre-built Images (Recommended)\n\n**No building required!** Pull and run pre-built images directly:\n\n```bash\n# Download the compose file\ncurl -fsSL https://raw.githubusercontent.com/kjangiti/PandmaVue.ai/main/infra/docker/compose/docker-compose.hub.yml -o docker-compose.yml\n\n# Start everything\ndocker compose up -d\n\n# View logs\ndocker compose logs -f\n\n# Stop\ndocker compose down\n```\n\n### Build from Source\n\n#### Lite Mode (No databases)\n```bash\ndocker compose -f infra/docker/compose/compose.lite.yml up --build -d\ndocker compose -f infra/docker/compose/compose.lite.yml logs -f\ndocker compose -f infra/docker/compose/compose.lite.yml down\n```\n\n#### Full Mode (With Neo4j + Qdrant)\n```bash\ndocker compose -f infra/docker/compose/compose.full.yml up --build -d\ndocker compose -f infra/docker/compose/compose.full.yml logs -f\ndocker compose -f infra/docker/compose/compose.full.yml down\n```\n\n> **Note:** If `docker compose` fails, try `docker-compose` (older Docker versions).\n\n### Services (Full Mode)\n\n| Service | URL |\n|---------|-----|\n| Frontend | http://localhost:3000 |\n| Backend | http://localhost:8000 |\n| Neo4j | http://localhost:7474 |\n| Qdrant | http://localhost:6333 |\n\n### Docker Images\n\nPre-built images available on GitHub Container Registry:\n\n| Image | Pull Command |\n|-------|--------------|\n| Backend | `docker pull ghcr.io/kjangiti/pandmavue.ai/backend:latest` |\n| Frontend | `docker pull ghcr.io/kjangiti/pandmavue.ai/frontend:latest` |\n\n**Tags available:**\n- `latest` — Latest stable build from main branch\n- `v1.0.0` — Specific version (semantic versioning)\n- `sha-abc123` — Specific commit\n\n---\n\n## 🤖 AI Provider Setup\n\nDefault: **Mock Mode** (no AI needed, sample responses)\n\n### Option 1: Ollama (Free, Local) ⭐ Recommended\n\n**Mac/Linux:**\n```bash\ncurl -fsSL https://ollama.com/install.sh | sh\nollama pull llama3.2\nollama serve\n```\n\n**Windows:**\n1. Download from https://ollama.com\n2. Run: `ollama pull llama3.2`\n3. Run: `ollama serve`\n\n### Option 2: LM Studio (Free, Local)\n1. Download from https://lmstudio.ai\n2. Load a model → Start local server\n\n### Option 3: Cloud Providers\nConfigure via **⚙️ Settings** in the app:\n- OpenAI (GPT-4)\n- Anthropic (Claude)\n- OpenRouter (100+ models)\n- Google Gemini\n- AWS Bedrock\n\n---\n\n## 🔒 Data Handling & Privacy\n\n### What's Stored Locally\n- Uploaded documents (`./uploads/`)\n- Analysis results (`./data/`)\n- Logs (`./logs/`)\n\n### What's Sent to AI Providers\n- **Mock Mode**: Nothing (offline)\n- **Ollama/LM Studio**: Nothing (local AI)\n- **Cloud Providers**: Document content for analysis\n\n### Running Fully Offline\n1. Use Mock Mode, Ollama, or LM Studio\n2. Use Lite Mode (no external databases)\n\n---\n\n## 📊 API Examples\n\n```bash\n# Health check\ncurl http://localhost:8000/health\n\n# Upload a document\ncurl -X POST http://localhost:8000/api/ingest \\\n -F \"files=@architecture.pdf\" \\\n -F \"project_name=MyProject\"\n\n# Run analysis\ncurl -X POST http://localhost:8000/api/analyze \\\n -H \"Content-Type: application/json\" \\\n -d '{\"project_id\": \"your-project-id\", \"methodology\": \"stride\"}'\n```\n\n**Full API Docs:** http://localhost:8000/docs\n\n---\n\n## 🏗️ Architecture\n\n```\n┌─────────────────────────────────────────────────────────┐\n│ Frontend (Next.js) │\n│ http://localhost:3000 │\n└─────────────────────────────────────────────────────────┘\n │\n ▼\n┌─────────────────────────────────────────────────────────┐\n│ Backend (FastAPI) │\n│ http://localhost:8000 │\n│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │\n│ │ Elicitation │ │ Threat │ │ Compliance │ │\n│ │ Agent │ │ Agent │ │ Agent │ │\n│ └─────────────┘ └─────────────┘ └─────────────┘ │\n│ LangGraph Orchestrator │\n└─────────────────────────────────────────────────────────┘\n │ (Full Mode only) │\n ▼ ▼\n┌───────────────────┐ ┌───────────────────┐\n│ Neo4j (GraphRAG) │ │ Qdrant (VectorRAG)│\n│ localhost:7474 │ │ localhost:6333 │\n└───────────────────┘ └───────────────────┘\n```\n\n---\n\n## 📁 Project Structure\n\n```\nPandmaVue.ai/\n├── start.sh / start.ps1 # Start scripts\n├── stop.sh / stop.ps1 # Stop scripts\n├── infra/\n│ └── docker/\n│ └── compose/ # Docker compose files\n│ ├── compose.lite.yml # Lite mode\n│ ├── compose.full.yml # Full mode\n│ └── docker-compose.hub.yml\n├── scripts/\n│ └── common/ # Shared script utilities\n├── backend/\n│ ├── app/\n│ │ ├── agents/ # LangGraph AI agents\n│ │ ├── api/ # REST endpoints\n│ │ └── engines/ # STRIDE, PASTA, DREAD\n│ └── requirements.txt\n├── frontend/\n│ ├── app/ # Next.js pages\n│ ├── components/ # React components\n│ └── package.json\n├── docs/ # BRD, FRD documentation\n└── env-templates/ # Configuration templates\n```\n\n---\n\n## 🔧 Configuration\n\nEnvironment variables in `backend/.env`:\n\n```bash\n# Storage mode: lite (default) or full\nSTORAGE_MODE=lite\n\n# LLM Provider: mock, ollama, openai, anthropic, etc.\nLLM_PROVIDER=mock\n\n# Ollama (if using)\nOLLAMA_BASE_URL=http://localhost:11434\nOLLAMA_MODEL=llama3.2\n```\n\nSee `env-templates/backend.env` for all options.\n\n---\n\n## ❓ Troubleshooting\n\n### \"Backend not connected\"\n```bash\ncurl http://localhost:8000/health # Should return {\"status\":\"healthy\"...}\n./stop.sh && ./start.sh # Restart\n```\n\n### \"Port already in use\"\n```bash\n# Mac/Linux\nlsof -ti :8000 | xargs kill -9\nlsof -ti :3000 | xargs kill -9\n\n# Windows\n.\\stop.ps1\n```\n\n### \"command not found: uvicorn\"\n```bash\ncd backend && source venv/bin/activate\n```\n\n### \"Execution Policy\" error (Windows)\n```powershell\npowershell -ExecutionPolicy Bypass -File start.ps1\n```\n\n### Reset everything\n```bash\n./start.sh --reset\n```\n\n---\n\n## 🔬 Features\n\n| Feature | Description |\n|---------|-------------|\n| STRIDE Analysis | Systematic threat categorization |\n| PASTA Methodology | 7-stage risk-centric analysis |\n| MAESTRO Framework | Agentic AI threat modeling (CSA) |\n| DREAD Scoring | Quantified risk (1-10 scale) |\n| Compliance Mapping | NIST 800-53, OWASP ASVS |\n| **OWASP Citations** | Deterministic reference mapping (no hallucination) |\n| DFD Generation | Mermaid data flow diagrams |\n| DevSecOps Rules | Checkov, tfsec, Semgrep |\n| MCP Integration | External security tools |\n\n### OWASP Reference Citations\n\nReports include deterministic mappings to OWASP guidance:\n\n| Reference | Scope |\n|-----------|-------|\n| [OWASP Top 10:2025](https://owasp.org/Top10/2025/) | Web application risks |\n| [OWASP LLM Top 10](https://genai.owasp.org/llm-top-10/) | LLM/GenAI security |\n| [OWASP Agentic AI Threats](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/) | Autonomous agent risks |\n| [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) | Agentic app Top 10 |\n| [GenAI Red Teaming Guide](https://genai.owasp.org/resource/genai-red-teaming-guide/) | AI security testing |\n\n**Hard Rules:**\n- References mapped deterministically (no hallucination)\n- If mapping rules don't match, findings are flagged for manual review\n- No claims of compliance - guidance references only\n\n---\n\n## 📚 References\n\n- [STRIDE](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)\n- [PASTA](https://owasp.org/www-project-threat-model/)\n- [MAESTRO (CSA)](https://cloudsecurityalliance.org/blog/2025/02/06/agentic-ai-threat-modeling-framework-maestro)\n- [NIST 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)\n- [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)\n- [OWASP GenAI](https://genai.owasp.org/)\n\n---\n\n## 🤝 Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## 🔐 Security\n\nSee [SECURITY.md](SECURITY.md) for reporting vulnerabilities.\n\n## 📄 License\n\nMIT License - See LICENSE file.\n\n---\n\nBuilt with ❤️ by PadmaVue.ai\n"}, "605007dfce61a41dbc02fe5c4c944e243ba03277": {"t": 1785771663.7959993, "n": 9459, "h": "00cb77d1c8059e69", "c": "# 🛡️ SecurityReview.ai\n\n**AI-Powered Security Review Platform** — Automated threat modeling, compliance mapping, and DevSecOps rule generation.\n\n---\n\n## 🚀 Quick Start\n\n### Mac / Linux\n```bash\nchmod +x start.sh\n./start.sh\n```\n\n### Windows (PowerShell)\n```powershell\n.\\start.ps1\n```\n\n**That's it!** Open http://localhost:3000\n\n> **First run?** Dependencies will be installed automatically (2-3 minutes).\n\n---\n\n## 📦 Two Modes\n\n| Mode | What's Included | Best For |\n|------|-----------------|----------|\n| **Lite** (default) | Backend + Frontend | Quick demos, development |\n| **Full** | + Neo4j + Qdrant | Production, large projects |\n\n```bash\n# Lite mode (default)\n./start.sh\n\n# Full mode (requires Docker)\n./start.sh --full\n```\n\n---\n\n## 🔄 How It Works\n\n```\n┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐\n│ Upload │───▶│ Elicitation │───▶│ DFD │───▶│ Threats │\n│ Documents │ │ Questions │ │ Generation │ │ + Report │\n└──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘\n```\n\n1. **Ingest** — Upload architecture docs, configs, or code\n2. **Elicitation** — AI asks clarifying questions about your system\n3. **DFD Generation** — Auto-generates data flow diagrams (Mermaid)\n4. **Threat Analysis** — STRIDE/PASTA analysis with DREAD scoring\n5. **Report** — Compliance mappings (NIST 800-53, OWASP ASVS) + DevSecOps rules\n\n---\n\n## 📋 Requirements\n\n| Requirement | Version | Check |\n|-------------|---------|-------|\n| Python | 3.11+ | `python3 --version` |\n| Node.js | 18+ | `node --version` |\n| npm | 9+ | `npm --version` |\n| Docker | (Full mode only) | `docker --version` |\n\n### Install Dependencies\n\n**macOS:**\n```bash\nbrew install python@3.11 node\n```\n\n**Ubuntu/Debian:**\n```bash\nsudo apt update && sudo apt install python3.11 python3.11-venv nodejs npm\n```\n\n**Windows:**\n```powershell\nwinget install Python.Python.3.11\nwinget install OpenJS.NodeJS\n```\n\n---\n\n## 🎯 Usage\n\n### Start Commands\n\n| Command | Mode | Description |\n|---------|------|-------------|\n| `./start.sh` | Lite | Backend + Frontend |\n| `./start.sh --full` | Full | + Neo4j + Qdrant (Docker) |\n| `./start.sh --backend` | Lite | Backend only |\n| `./start.sh --frontend` | Lite | Frontend only |\n| `./start.sh --reset` | - | Clean reinstall |\n\n**Windows:** Replace `./start.sh` with `.\\start.ps1` and `--` with `-` (e.g., `.\\start.ps1 -Full`)\n\n### Stop Commands\n\n```bash\n./stop.sh # Mac/Linux\n.\\stop.ps1 # Windows\n# Or press Ctrl+C\n```\n\n---\n\n## 🐳 Docker\n\n### ⚡ Quick Start with Pre-built Images (Recommended)\n\n**No building required!** Pull and run pre-built images directly:\n\n```bash\n# Download the compose file\ncurl -fsSL https://raw.githubusercontent.com/kjangiti/Securityreview.ai/main/docker-compose.hub.yml -o docker-compose.yml\n\n# Start everything\ndocker compose up -d\n\n# View logs\ndocker compose logs -f\n\n# Stop\ndocker compose down\n```\n\n**Or run directly:**\n```bash\ndocker compose -f docker-compose.hub.yml up -d\n```\n\n> Images are automatically updated on every code change to `main` branch.\n\n### Build from Source\n\n#### Lite Mode (No databases)\n```bash\ndocker compose -f compose.lite.yml up --build -d\ndocker compose -f compose.lite.yml logs -f\ndocker compose -f compose.lite.yml down\n```\n\n#### Full Mode (With Neo4j + Qdrant)\n```bash\ndocker compose -f compose.full.yml up --build -d\ndocker compose -f compose.full.yml logs -f\ndocker compose -f compose.full.yml down\n```\n\n> **Note:** If `docker compose` fails, try `docker-compose` (older Docker versions).\n\n### Services (Full Mode)\n\n| Service | URL |\n|---------|-----|\n| Frontend | http://localhost:3000 |\n| Backend | http://localhost:8000 |\n| Neo4j | http://localhost:7474 |\n| Qdrant | http://localhost:6333 |\n\n### Docker Images\n\nPre-built images available on GitHub Container Registry:\n\n| Image | Pull Command |\n|-------|--------------|\n| Backend | `docker pull ghcr.io/kjangiti/securityreview.ai/backend:latest` |\n| Frontend | `docker pull ghcr.io/kjangiti/securityreview.ai/frontend:latest` |\n\n**Tags available:**\n- `latest` — Latest stable build from main branch\n- `v1.0.0` — Specific version (semantic versioning)\n- `sha-abc123` — Specific commit\n\n---\n\n## 🤖 AI Provider Setup\n\nDefault: **Mock Mode** (no AI needed, sample responses)\n\n### Option 1: Ollama (Free, Local) ⭐ Recommended\n\n**Mac/Linux:**\n```bash\ncurl -fsSL https://ollama.com/install.sh | sh\nollama pull llama3.2\nollama serve\n```\n\n**Windows:**\n1. Download from https://ollama.com\n2. Run: `ollama pull llama3.2`\n3. Run: `ollama serve`\n\n### Option 2: LM Studio (Free, Local)\n1. Download from https://lmstudio.ai\n2. Load a model → Start local server\n\n### Option 3: Cloud Providers\nConfigure via **⚙️ Settings** in the app:\n- OpenAI (GPT-4)\n- Anthropic (Claude)\n- OpenRouter (100+ models)\n- Google Gemini\n- AWS Bedrock\n\n---\n\n## 🔒 Data Handling & Privacy\n\n### What's Stored Locally\n- Uploaded documents (`./uploads/`)\n- Analysis results (`./data/`)\n- Logs (`./logs/`)\n\n### What's Sent to AI Providers\n- **Mock Mode**: Nothing (offline)\n- **Ollama/LM Studio**: Nothing (local AI)\n- **Cloud Providers**: Document content for analysis\n\n### Running Fully Offline\n1. Use Mock Mode, Ollama, or LM Studio\n2. Use Lite Mode (no external databases)\n\n---\n\n## 📊 API Examples\n\n```bash\n# Health check\ncurl http://localhost:8000/health\n\n# Upload a document\ncurl -X POST http://localhost:8000/api/ingest \\\n -F \"files=@architecture.pdf\" \\\n -F \"project_name=MyProject\"\n\n# Run analysis\ncurl -X POST http://localhost:8000/api/analyze \\\n -H \"Content-Type: application/json\" \\\n -d '{\"project_id\": \"your-project-id\", \"methodology\": \"stride\"}'\n```\n\n**Full API Docs:** http://localhost:8000/docs\n\n---\n\n## 🏗️ Architecture\n\n```\n┌─────────────────────────────────────────────────────────┐\n│ Frontend (Next.js) │\n│ http://localhost:3000 │\n└─────────────────────────────────────────────────────────┘\n │\n ▼\n┌─────────────────────────────────────────────────────────┐\n│ Backend (FastAPI) │\n│ http://localhost:8000 │\n│ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │\n│ │ Elicitation │ │ Threat │ │ Compliance │ │\n│ │ Agent │ │ Agent │ │ Agent │ │\n│ └─────────────┘ └─────────────┘ └─────────────┘ │\n│ LangGraph Orchestrator │\n└─────────────────────────────────────────────────────────┘\n │ (Full Mode only) │\n ▼ ▼\n┌───────────────────┐ ┌───────────────────┐\n│ Neo4j (GraphRAG) │ │ Qdrant (VectorRAG)│\n│ localhost:7474 │ │ localhost:6333 │\n└───────────────────┘ └───────────────────┘\n```\n\n---\n\n## 📁 Project Structure\n\n```\nSecurityreview.ai/\n├── start.sh / start.ps1 # Start scripts\n├── stop.sh / stop.ps1 # Stop scripts\n├── compose.lite.yml # Docker: backend + frontend\n├── compose.full.yml # Docker: + Neo4j + Qdrant\n├── backend/\n│ ├── app/\n│ │ ├── agents/ # LangGraph AI agents\n│ │ ├── api/ # REST endpoints\n│ │ └── engines/ # STRIDE, PASTA, DREAD\n│ ├── venv/ # Python virtual environment\n│ └── requirements.txt\n├── frontend/\n│ ├── app/ # Next.js pages\n│ ├── components/ # React components\n│ └── package.json\n└── env-templates/ # Configuration templates\n```\n\n---\n\n## 🔧 Configuration\n\nEnvironment variables in `backend/.env`:\n\n```bash\n# Storage mode: lite (default) or full\nSTORAGE_MODE=lite\n\n# LLM Provider: mock, ollama, openai, anthropic, etc.\nLLM_PROVIDER=mock\n\n# Ollama (if using)\nOLLAMA_BASE_URL=http://localhost:11434\nOLLAMA_MODEL=llama3.2\n```\n\nSee `env-templates/backend.env` for all options.\n\n---\n\n## ❓ Troubleshooting\n\n### \"Backend not connected\"\n```bash\ncurl http://localhost:8000/health # Should return {\"status\":\"healthy\"...}\n./stop.sh && ./start.sh # Restart\n```\n\n### \"Port already in use\"\n```bash\n# Mac/Linux\nlsof -ti :8000 | xargs kill -9\nlsof -ti :3000 | xargs kill -9\n\n# Windows\n.\\stop.ps1\n```\n\n### \"command not found: uvicorn\"\n```bash\ncd backend && source venv/bin/activate\n```\n\n### \"Execution Policy\" error (Windows)\n```powershell\npowershell -ExecutionPolicy Bypass -File start.ps1\n```\n\n### Reset everything\n```bash\n./start.sh --reset\n```\n\n---\n\n## 🔬 Features\n\n| Feature | Description |\n|---------|-------------|\n| STRIDE Analysis | Systematic threat categorization |\n| PASTA Methodology | 7-stage risk-centric analysis |\n| DREAD Scoring | Quantified risk (1-10 scale) |\n| Compliance Mapping | NIST 800-53, OWASP ASVS |\n| DFD Generation | Mermaid data flow diagrams |\n| DevSecOps Rules | Checkov, tfsec, Semgrep |\n| MCP Integration | External security tools |\n\n---\n\n## 📚 References\n\n- [STRIDE](https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)\n- [PASTA](https://owasp.org/www-project-threat-model/)\n- [NIST 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)\n- [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/)\n\n---\n\n## 🤝 Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n## 🔐 Security\n\nSee [SECURITY.md](SECURITY.md) for reporting vulnerabilities.\n\n## 📄 License\n\nMIT License - See LICENSE file.\n\n---\n\nBuilt with ❤️ by SecurityReview.ai\n"}}}} |